Cleanup: delete dead top-level pages + update docs (Slice 11)

Delete the old top-level page files whose content was migrated into
service-page tabs in slices 5-9:
- pages/Media.tsx, Applications.tsx (-> MediaTab)
- pages/FileBrowser.tsx, FileBrowser.impl.tsx (-> FilesTab)
- pages/Actions.tsx (-> ActionsTab)
- pages/Users.tsx, UsersPage.impl.tsx (replaced by Authentik tabs)
- components/BackupsPage.tsx (-> JobsTab)
- components/ObservabilityPage.tsx (split into Alerts/Links/Metrics tabs)
- hooks/useUsers.ts (orphaned after Users page deletion)
- the corresponding page test files (Media, FileBrowser, Applications,
  Actions, UsersPage) that tested the deleted pages directly.

The service-tab components are the live implementations; ServicePage
renders them. No live code references the deleted files.

Docs: append an Information Architecture section to REQUIREMENTS.md
documenting the services-as-hub model (nav shape, service-page tabs,
service type registry, Users->Authentik, Observability split, legacy
route 404s, empty state). Add a CHANGELOG entry under [Unreleased].

92 frontend tests pass (was 112; -20 deleted page tests); 271 backend
tests pass; lint/build green.

Refs openspec/changes/services-as-hub-ia/ (tasks slice 11).

CHANGELOG.md

@@ -4,6 +4,32 @@ All notable changes to Manage. Breaking changes are marked with **BREAKING**.
 
 ## [Unreleased]
 
+### Added — Services-as-hub IA rework
+
+- **BREAKING:** Top-level navigation reorganized around services as the hub.
+  The always-visible core is Main Dashboard, Services, Settings. Conditional
+  per-type entries (Media, Files, Actions, Alerts, Grafana, Prometheus,
+  Backups, Users) appear only when a matching service is configured. Legacy
+  top-level routes (`/media`, `/files`, `/actions`, `/users`, `/observability`,
+  `/backups`) now return 404.
+- **NEW service types:** `backups` (modeled as a service; reports attribute
+  first-wins to an enabled instance via `?service_id=`) and `authentik`
+  (user-directory source; replaces the Jellyfin-backed Users page).
+- **Jellyseerr absorbed** into Jellyfin config (optional `jellyseerr_url` /
+  `jellyseerr_api_key`). Existing Jellyseerr service instances are migrated
+  into their paired Jellyfin at startup; unpaired instances are dropped with
+  a logged warning.
+- **Service pages** now use a tab skeleton `[Overview | content tabs | Widgets |
+  Config]`. Operational content (Media, Files, Actions, Backups, Users,
+  Messaging, Alerts, Links, Metrics) lives in per-type tabs. An instance
+  switcher appears when >1 enabled instance of a type exists.
+- **Named dashboards** at `/d/:slug` — user-created top-level entries composed
+  of pinned service links (full widget composition is a follow-up).
+- **Authentik directory endpoint:** `GET /api/services/authentik/{id}/users`
+  (paginated, searchable). `POST .../message` enqueues emails via the existing
+  SMTP/mail queue.
+- **Users router removed** (Jellyfin-backed directory + Jellyfin-email compose).
+
 ### Added — Observability service registry
 
 - **Alertmanager is now a service type.** Configure Alertmanager, Grafana, and